The NSA Guidelines for Spying on You Are Looser Than You've Been Told

On July 28, 2009, 189 days after Barack Obama became president, Attorney General Eric Holder (himself only six months into office) presented the secret Foreign Intelligence Surveillance Court (FISC) with a list of ways in which the NSA and FBI would try and assure that the data it collected under the Foreign Intelligence Surveillance Act came only from non-Americans. The delineation, released today by The Guardian, includes several ways in which collection of data from Americans is both likely — and allowed.

Members of both the House and the Senate have called for the release of documents that do precisely what these do: outline how and when the NSA might collect domestic data, and how it tries not to. One of the points these documents raise is that, given the breadth of the agency's collection efforts, collecting data from Americans almost necessarily occurs. According to a separate, one-paragraph document The Guardian has seen, however, the FISC found the procedures described by Holder to be "consistent with US law and the fourth amendment."

The top secret documents published today detail the circumstances in which data collected on US persons under the foreign intelligence authority must be destroyed, extensive steps analysts must take to try to check targets are outside the US, and reveals how US call records are used to help remove US citizens and residents from data collection.

To avoid including Americans (technically, "US persons") in its sweeps, the NSA asks several questions about a target.

If the person passes that test, the NSA further examines the data it collects for signs that the person might or might not be an American, including checks against known phone numbers and IP address data. Or if the person happens to be a "buddy" of a foreign intelligence official.

Should the data not pass these tests — if, in other words, the NSA believes the data does pertain to an American — it doesn't necessarily have to get rid of the data. Greenwald outlines three examples in which the NSA can keep and use data collected from Americans.

Retain and make use of "inadvertently acquired" domestic communications if they contain usable intelligence, information on criminal activity, threat of harm to people or property, are encrypted, or are believed to contain any information relevant to cybersecurity;

And, as attorney Amie Stepanovich noted, the NSA keeps email addresses and phone numbers it knows belong to Americans in order to identify other people as being American or not.

Incidentally, if the NSA can't figure out whether or not a person is an American, it is allowed to assume that the person is not, according to Greenwald.

"In the absence of specific information regarding whether a target is a United States person," it states "a person reasonably believed to be located outside the United States or whose location is not known will be presumed to be a non-United States person unless such person can be positively identified as a United States person."

Again, the scope of the NSA's authorization means that scooping up data from Americans would be almost unavoidable. That scope is, of course, up for debate. But these two documents also raise significant questions about the repeated assurances that the NSA doesn't intentionally collect information on Americans under Section 702. Maybe not. But the rules as proscribed are much looser than the agency has implied.